Re: [BUG]: slab-use-after-free Write in sco_conn_put

[haoran zheng]

> RACE CONDITION SEQUENCE:
>    a) Task 31374 releases socket, eventually leading to sco_conn_free()
>    b) sco_conn_free() sets hcon->sco_data = NULL and calls kfree(conn)
>    c) Task 352 (workqueue) executes hci_conn_failed() -> sco_connect_cfm()
>    d) sco_connect_cfm() calls sco_conn_del(hcon, bt_to_errno(status))
>    e) sco_conn_del() attempts to access already-freed sco_conn via
> hcon->sco_data

I think this vulnerability should be located at sco_pi(conn->sk)->conn = NULL;

Specifically, when sco_sock_release is called in the Free Path,
conn->sk is set to NULL under the protection of sco_conn_lock(conn),
and the TOCTOU problem occurs at line 87 of sco.c. When performing the
if (conn->sk) judgment, conn->sk has not been free yet. However, when
sco_sock_release is called After the judgment is executed, resulting
in conn->sk being free, it causes Use After Free.